Skip to content

Clarify default delivery branch behavior in security guidance #2266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 2 commits into from
Closed

Clarify default delivery branch behavior in security guidance #2266

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c9c5251
Initial plan
Copilot May 27, 2026
dd1a072
docs: clarify DeliverTo branch default in delivery target guidance
Copilot May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions Scenarios/DeliveryTargets.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,6 +347,17 @@ You can configure multiple trusted NuGet feeds for dependency resolution:
- **Token expiration**: Regularly rotate your personal access tokens
- **Compressed JSON**: Always use compressed JSON format for secrets to avoid masking issues

#### Protect the branches that publish to delivery targets

Unlike the deployment jobs in AL-Go (which run inside a GitHub *environment* and can therefore be gated by environment protection rules), the `Deliver` jobs in the AL-Go CI/CD workflows do not declare a GitHub `environment:`. Their context secrets (`GitHubPackagesContext`, `NuGetContext`, `StorageContext`, `AppSourceContext`, or any custom `<DeliveryTarget>Context`) are read as repository or organization secrets, so GitHub *deployment branches and tags* and *required reviewers* do **not** apply to delivery as currently shipped.

In practice, this means the security boundary for delivery is the set of branches that are allowed to run the delivery step. Hardening recommendations:

- **Restrict the delivery branches in AL-Go.** Always set `DeliverTo<Target>.Branches` to an explicit allowlist (for example `["main", "release/*"]`). If omitted, AL-Go defaults this setting to `["main"]`; set it explicitly for clarity and hardening.
- **Protect the listed branches.** Add a [branch protection rule or ruleset](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches) on every branch named in `DeliverTo<Target>.Branches` that requires pull requests, reviews, a passing AL-Go build status check, restricts who can push directly, and disallows bypassing the rule. This is what prevents arbitrary code on those branches from running with the delivery secret.
- **Scope the secret to the smallest audience.** Use a repository secret (rather than an organization secret) when only one repository needs to publish, and use the most restrictive credential available for each target: PATs scoped to `write:packages` only for GitHub Packages, dedicated feed-scoped tokens (or federated credentials) for NuGet, SAS tokens with the minimum required permissions and a short expiry for Azure Storage, and S2S/federated credentials for AppSource. Rotate them on a schedule.
- **Keep an eye on settings changes.** Because `DeliverTo<Target>.Branches` lives in `.github/AL-Go-Settings.json`, the branch protection rule on your release branches is also what prevents this allowlist from being silently widened.

### Limitations

- **Fine-grained tokens**: GitHub Packages doesn't support fine-grained personal access tokens yet
Expand Down
Loading